Key facts
- Organisation
- Singapore industrial firm
- Threat
- Ransomware, deployed by a ransomware-as-a-service operation
- Initial access
- A shared remote-access account with no second authentication factor
- Impact
- Encryption of both virtualisation hosts, compromising all hosted virtual machines as well as the co-located backup server
- Core issue
- One unused shared login carried unrestricted reach across the entire internal network
What this case shows
- Unmonitored, not dormant: An account that sees no legitimate use is not dormant; it is simply unmonitored.
- Inadequate backup isolation: A backup system co-located on the very cluster it safeguards offers no true protection.
- Patching versus remediation: Applying a software patch remedies a vulnerability, but it does not remove an adversary that has already established access.
- Log retention deficits: Critical investigative evidence is frequently purged by routine retention policies well before a breach is detected.
If you suspect someone already has a foothold in your network, Blackpanda's compromise assessment finds it, and emergency incident response contains it.
What this would have cost without Blackpanda IR-1 in place
| ODIR | IR-1 | |
|---|---|---|
| Type of engagement | On-demand incident response | Yearly subscription |
| Hours covered | 85 hours | Unlimited* |
| Pricing1 | USD $42,500 | USD $4,250 |
* Unlimited for one incident per year
1 Ad-hoc incident response pricing based on average market rates, from USD 500 per hour. Blackpanda IR-1 subscription pricing based on no. of endpoints, costing approx. 10x less than ad-hoc and retainer-based incident response. All figures are illustrative only, for guidance and marketing purposes and not to be relied upon by the reader. Actual incident response costs vary by scope, complexity, and provider.
CHALLENGE
The company operated entirely across two virtualisation hosts, which housed all of its virtual machines — including the file server containing human resources, accounting, procurement, and personal records. The backup server was co-located on the same cluster. Remote access for staff was managed through the firewall's remote-access service, where a shared account, originally created for testing purposes, remained active. The account was neither actively used nor monitored.
During the early morning hours of a Sunday in May 2026, both virtualisation hosts were encrypted simultaneously. Ransomware executing at the hypervisor level bypasses individual workstations entirely, locking down the underlying infrastructure in one swift motion. Dropping offline almost instantly, faster than any manual action, the two hosts took down all dependent virtual machines, including the firm's backup system. Consequently, the company's financial records, internal accounts, and backup archives were rendered inaccessible under a single encryption key, with extortion notes left across every storage volume.
Beyond that Sunday's incident, an unobserved secondary threat persisted. Months prior, an attacker gained administrative access to the firm's firewall by exploiting a critical authentication-bypass vulnerability in the vendor's software, publicly tracked as CVE-2026-24858. This allowed the creation of three unauthorised administrator accounts on the device. Although the firm subsequently patched the vulnerability and resolved the security flaw, those administrative accounts remained active on the firewall.
SOLUTION
The firm's external legal counsel instructed Blackpanda to investigate, and the IR-1 credit was activated the same day.
1. Establish the entry point before the evidence expired
Blackpanda's response team focused immediately on the remote-access portal, as it served as the sole external entry point into the network. Session records revealed that the shared test account authenticated and instantly initiated automated directory queries, a pattern inconsistent with legitimate human activity. Further analysis identified two concurrent tunnels operating under this single set of credentials. However, the attacker's source address and precise timestamp of initial access could not be retrieved, as the firewall's log retention was capped at seven days and the relevant authentication records had already been overwritten prior to the investigation request.
2. Reconstruct the lateral movement from what survived
Without access to the authentication logs, Blackpanda relied on host artefacts and network traffic data to reconstruct the intrusion. Over its initial hours, the account initiated more than 80,000 directory look-ups directed at the domain controller, a level of activity impossible for a human session to generate. The attacker subsequently scanned approximately 4,000 internal addresses sequentially in search of file-sharing services. Accessing the file server and backup server via remote desktop, the attacker maintained an open session on the backup server to serve as a staging point throughout the encryption process. The overall sequence of lateral movement remained fully automated from start to finish.
3. Test the exfiltration question three separate ways
Because extortion threat actors typically exfiltrate data prior to encryption, answering whether data theft occurred was the primary concern for the firm's counsel. Blackpanda addressed this question by evaluating three distinct vectors:
- Perimeter tunnel analysis: Egress traffic through the remote-access tunnel totalled approximately 100 MB, with actual file content accounting for less than 1 MB.
- Internal egress auditing: Outbound connections across all major internal servers revealed no evidence of mass data transfer; the single largest outbound flow was under 15 MB, generated by a legitimate monitoring appliance.
- Disk forensics: By leveraging the partial-encryption behaviour of the ransomware, the team restored roughly half of the encrypted file-server volume to search for exfiltration utilities or associated artefacts, confirming none were present.
4. Trace the root cause upstream of the ransomware
With the origin of the credentials still unaccounted for, Blackpanda audited the firewall directly. Because the device's seven-day logs had already expired, the team rebuilt its firmware timeline using records from the management portal. This reconstruction revealed that the firewall had run an unpatched, vulnerable firmware version during an active exploit window. Furthermore, three administrative accounts present on the system aligned with the vendor's published indicators of compromise for that vulnerability. The firm verified it had never set up those accounts.
RESULTS
1. Entry route confirmed and closed
Blackpanda established that the attacker entered through a shared remote-access account with no second authentication factor, and the firm disabled it during the response.
2. A single firewall rule explained the speed
One policy granted the remote-access groups unrestricted reach across the internal network, on every service, at all hours. That is why one shared login was enough to get from the perimeter to the hypervisors.
3. Extortion leverage assessed as absent
Across network traffic, outbound server activity and host forensics, Blackpanda found no evidence of bulk data theft, and said so plainly while stating the limits of what the surviving evidence could prove.
4. A second, older compromise surfaced
The investigation found unauthorised administrative access on the firewall that had persisted for around five months and had survived a firmware upgrade, because local administrator accounts are not removed when software is patched.
5. Defensive gaps documented for remediation
No multi-factor authentication on remote access, overly permissive VPN policies, log retention limited to seven days on the primary external logging gateway, and active remote command-line access left exposed to the VPN across both hypervisors.
The most concerning element of this incident was not the deployment of the ransomware itself, but rather the preceding five months during which an unauthorised party maintained administrative access to the firm's core security gateway without triggering any system alerts.
This vulnerability mirrors an unpatched, internet-facing server left exposed long enough for an adversary to establish persistent access. Two cost-effective countermeasures would have prevented this outcome: enforcing multi-factor authentication across all remote-access credentials, including test environments, and maintaining off-cluster backup isolation. Furthermore, extending perimeter log retention beyond the seven-day threshold would ensure critical forensic evidence remains available, as short retention periods often overwrite intrusion logs prior to detection.
FREQUENTLY ASKED QUESTIONS
1. How did attackers get in without stealing anyone's password?
They used an account that already existed and that nobody was monitoring, a shared test login on the remote-access service with no second authentication factor. Blackpanda could not conclusively determine how the credentials were obtained, though the earlier firewall compromise is the most plausible source, since administrative control of that device allows an attacker to view, change or reset remote-access accounts. Test and service accounts are a recurring blind spot precisely because no individual owns them, so no individual notices when they behave strangely.
2. Would multi-factor authentication have stopped this?
On this entry route, almost certainly. A password-only account on an internet-facing service is a single point of failure, and adding a second factor removes it. Multi-factor authentication is not a complete defence, and Blackpanda has investigated cases where attackers defeated it by relaying a live session through a convincing fake login page, as we documented at a Singapore IT services firm. That is an argument for layering, not for skipping the layer.
3. Why did the backup not help?
Because it was running as a virtual machine on the same cluster the ransomware encrypted. Ransomware operating at the virtualisation layer encrypts every machine on the host, and a backup server hosted there is simply one more of them. A backup only counts as a backup if it survives the failure of the thing it protects, which in practice means keeping a copy offline, immutable, or on separate infrastructure.
4. What was the vulnerability in the firewall?
CVE-2026-24858, a critical authentication bypass in the vendor's firewall software, rated 9.4 on the Common Vulnerability Scoring System. The vendor found it being exploited in the wild by two malicious cloud accounts, which were locked out in late January 2026, and disabled the affected single sign-on service on its own side days later. CISA published guidance on the ongoing exploitation, noting that devices already patched against two earlier single sign-on bypass flaws remained vulnerable to this one, and that attackers were making unauthorised firewall configuration changes, creating accounts, and altering VPN settings to grant those accounts access.
5. If the firewall was patched, why did the attacker still have access?
Patching removes the vulnerability, not the attacker. The three unauthorised administrator accounts created during the original compromise were local accounts on the device, and local accounts survive firmware upgrades. This is why remediation after an edge-device compromise has to include an account audit and a credential rotation, and why organisations that patched during a mass-exploitation event should still assume they need to check.
WHAT THIS MEANS FOR YOUR ORGANISATION
Treating a patched vulnerability as a resolved security issue is a common oversight that this case directly challenges. Months prior to the ransomware deployment, the firm remediated the firewall flaw in full accordance with the vendor's advisory. However, no post-patch audit was conducted to identify pre-existing breaches. As a result, three unauthorised administrator accounts remained undetected on the firewall for nearly five months until discovered during an independent investigation. With mass-exploitation of edge devices recurring frequently, organisations that successfully patch vulnerabilities may still remain quietly compromised.
To mitigate these risks, organisations should prioritise two immediate actions:
- Audit remote-access accounts: Conduct a comprehensive inventory of all remote-access credentials, removing unassigned accounts or enforcing multi-factor authentication.
- Isolate backups: Verify that at least one backup copy is stored completely independent of the primary infrastructure.
For organisations that applied edge-device patches without auditing device modifications, a compromise assessment provides a definitive method to detect persistent threats. Should active unauthorised access be confirmed, IR-1 provides full incident response coverage.
ABOUT BLACKPANDA
Blackpanda is a Lloyd's of London–accredited insurance coverholder and Asia's leading local cyber incident response firm, delivering end-to-end digital emergency support across the region. We are pioneering the A2I (Assurance-to-Insurance) model in cybersecurity — uniting preparation, response, and insurance into a seamless pathway that minimises financial and operational impact from cyber attack. Through expert consulting services, response assurance subscriptions, and innovative cyber insurance, we help organisations get ready, respond, and recover from cyber attacks — all delivered by local specialists working in concert.
Our mission is clear: to bring complete cyber peace of mind to every organisation in Asia, from the first moment of breach through full recovery and beyond.
